Miasma/MYRA npm Transitive Dep Side-Loading: node.exe Credential File Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects node.js processes accessing sensitive configuration files, SSH keys, browser login databases, and other credential stores. This activity is indicative of malicious transitive dependencies within the npm ecosystem attempting to exfiltrate credentials during module initialization, even when top-level install scripts are restricted.